Summary: | HTML escaped via JavaScript should encode all entities | ||
---|---|---|---|
Product: | Koha | Reporter: | Kyle M Hall (khall) <kyle> |
Component: | Architecture, internals, and plumbing | Assignee: | Bugs List <koha-bugs> |
Status: | NEW --- | QA Contact: | Testopia <testopia> |
Severity: | enhancement | ||
Priority: | P5 - low | CC: | dcook, kyle, phil |
Version: | Main | ||
Hardware: | All | ||
OS: | All | ||
GIT URL: | Change sponsored?: | --- | |
Patch complexity: | --- | Documentation contact: | |
Documentation submission: | Text to go in the release notes: | ||
Version(s) released in: | Circulation function: | ||
Bug Depends on: | 36382 | ||
Bug Blocks: |
Description
Kyle M Hall (khall)
2024-03-21 13:47:33 UTC
(In reply to Kyle M Hall from comment #0) > In staff-global.js, we have a function escape_str. This function only > encodes a tiny subset of html characters. We should use > https://github.com/mathiasbynens/he to encode the full set of html entities. In theory, escape_str might work as a "HtmlAttributeEncode" method if it were to include double quotes, single quotes, ampersands, and angle brackets. But I think we're trying to use it in context where a full HTML entity encode is needed. Overall, I think we should be writing better Javascript, but adding layers of protection is useful I think. |